feat: Payment Terminal Compliance Modul — Phase 1+2

1. Control-Bibliothek: 130 Controls in 10 Domaenen (payment_controls_v1.json)
   - PAY (20): Transaction Flow, Idempotenz, State Machine
   - LOG (15): Audit Trail, PAN-Maskierung, Event-Typen
   - CRYPTO (15): Secrets, HSM, P2PE, TLS
   - API (15): Auth, RBAC, Rate Limiting, Injection
   - TERM (15): ZVT/OPI, Heartbeat, Offline-Queue
   - FW (10): Firmware Signing, Secure Boot, Tamper Detection
   - REP (10): Reconciliation, Tagesabschluss, GoBD
   - ACC (10): MFA, Session, Least Privilege
   - ERR (10): Recovery, Circuit Breaker, Offline-Modus
   - BLD (10): CI/CD, SBOM, Container Scanning
2. Backend: DB Migration 024, Go Handler (5 Endpoints), Routes
3. Frontend: /sdk/payment-compliance mit Control-Browser + Assessment-Wizard

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ai-compliance-sdk/migrations/024_payment_compliance_schema.sql

@@ -0,0 +1,45 @@
+-- Migration 024: Payment Compliance Schema
+-- Tracks payment terminal compliance assessments against control library
+
+CREATE TABLE IF NOT EXISTS payment_compliance_assessments (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id UUID NOT NULL,
+
+    -- Project / Tender
+    project_name VARCHAR(500) NOT NULL,
+    tender_reference VARCHAR(200),
+    customer_name VARCHAR(500),
+    description TEXT,
+
+    -- Scope
+    system_type VARCHAR(100), -- terminal, backend, both, full_stack
+    payment_methods JSONB DEFAULT '[]'::jsonb, -- ["card", "nfc", "girocard", "credit"]
+    protocols JSONB DEFAULT '[]'::jsonb, -- ["zvt", "opi", "emv"]
+
+    -- Assessment
+    total_controls INT DEFAULT 0,
+    controls_passed INT DEFAULT 0,
+    controls_failed INT DEFAULT 0,
+    controls_partial INT DEFAULT 0,
+    controls_not_applicable INT DEFAULT 0,
+    controls_not_checked INT DEFAULT 0,
+    compliance_score NUMERIC(5,2) DEFAULT 0,
+
+    -- Status
+    status VARCHAR(50) DEFAULT 'draft',
+    -- CHECK (status IN ('draft', 'in_progress', 'completed', 'approved'))
+
+    -- Results (per control)
+    control_results JSONB DEFAULT '[]'::jsonb,
+    -- Each entry: {"control_id": "PAY-001", "verdict": "passed|failed|partial|na|unchecked", "evidence": "...", "notes": "..."}
+
+    -- Audit
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW(),
+    created_by VARCHAR(200),
+    approved_by VARCHAR(200),
+    approved_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_pca_tenant ON payment_compliance_assessments (tenant_id);
+CREATE INDEX IF NOT EXISTS idx_pca_status ON payment_compliance_assessments (status);